@adep/cli@0.1.3: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@adep/cli@0.1.3: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/index.jsView file

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L49: const raw = await readFile(paths.credentialsFile, "utf8"); L50: const parsed = JSON.parse(raw); L51: if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") { ... L166: headers: { "content-type": "application/json" }, L167: body: JSON.stringify({ email: input.email, password: input.password }) L168: });

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

42if (mode !== 384) { L43: const { chmod } = await import("node:fs/promises"); L44: await chmod(file, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L42

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L49: const raw = await readFile(paths.credentialsFile, "utf8"); L50: const parsed = JSON.parse(raw); L51: if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") { ... L166: headers: { "content-type": "application/json" }, L167: body: JSON.stringify({ email: input.email, password: input.password }) L168: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

3556const require2 = (request) => { const resolved = resolveModulePath(dir, request, files); if (resolved !== null) { return loadModule(resolved, files, sandboxGlobals, cache, resolveBare, bareCache); } if (resolveBare !== void 0 && !request.startsWith("./") && !request.startsWith("../")) { const cachedModule = bareCache?.get(request); if (cachedModule !== void 0) return cachedModule; const loaded = resolveBare(request); bareCache?.set(request, loaded); return loaded; } const error = new Error( `\u6C99\u7BB1\u62D2\u7EDD\u8BE5\u5F

Low

Ai Review Evidence

The local development runtime evaluates user function modules in a VM context.

dist/index.jsView on unpkg · L3556

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

11

12// packages/cli/src/config.ts

13function resolvePaths(env = process.env) {

14 const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`;

15 return { home, credentialsFile: `${home}/credentials` };

16}

17function resolveServer(env = process.env) {

18 return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, "");

19}

20var init_config = __esm({

21 "packages/cli/src/config.ts"() {

22 "use strict";

23 }

24});

25

26// packages/cli/src/credentials.ts

27import { mkdir, open, readFile, rm, stat } from "node:fs/promises";

28import { dirname } from "node:path";

29async function saveCredentials(paths, credentials) {

30 await mkdir(dirname(paths.credentialsFile), { recursive: true });

31 const handle = await open(paths.credentialsFile, "w", 384);

32 try {

33 await handle.writeFile(JSON.stringify(credentials, null, 2));

34 } finally {

35 await handle.close();

36 }

37 await chmodStrict(paths.credentialsFile);

38}

39async function chmodStrict(file) {

40 const info = await stat(file);

41 const mode = info.mode & 511;

42 if (mode !== 384) {

43 const { chmod } = await import("node:fs/promises");

44 await chmod(file, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L42

45 }

46}

47async function loadCredentials(paths) {

48 try {

49 const raw = await readFile(paths.credentialsFile, "utf8");

50 const parsed = JSON.parse(raw);

51 if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.js

52 return null;

53 }

54 return {

55 server: parsed["server"],

56 email: parsed["email"],

57 encodedToken: parsed["encodedToken"]

58 };

59 } catch {

60 return null;

61 }

62}

Lines 3536-3576javascript

3536 if (part === "" || part === ".") continue;

3537 if (part === "..") stack.pop();

3538 else stack.push(part);